Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 12:52
Behavioral task
behavioral1
Sample
fpsbooster.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
creal.pyc
Resource
win10v2004-20240508-en
General
-
Target
fpsbooster.exe
-
Size
10.6MB
-
MD5
ae8472fb1d1cd4b552e713c496a8ea5c
-
SHA1
974a150578fe2879b9f16c50d8c6ce722457d440
-
SHA256
bb7bfe39f1aa1ec4ef6463630c97d5186de1a4593488f11f2ed2498b5a3f7597
-
SHA512
f725e799abe0cf0f6a21968d06259f44f2efdfb170e1c59e06cc51806c7ecbf8d42c237ac693e5d03d67ab545dc8eab90835e753968d4559b792c297026f1fed
-
SSDEEP
196608:kzEkobwrHLDuWJysVYvsOIroyMxxvjDDAxlfe6df/dHzmHZ3v9oxXTya+BuGPlsh:mEkomHmWJZoyMxtDDAxlfxdf/dHWZ3lO
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fpsbooster.exe fpsbooster.exe -
Loads dropped DLL 41 IoCs
pid Process 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe 3620 fpsbooster.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 40 discord.com 17 discord.com 18 discord.com 30 discord.com 37 discord.com -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 api.ipify.org 10 api.ipify.org 28 api.ipify.org 34 api.ipify.org 38 api.ipify.org -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1536 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1536 tasklist.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4216 wrote to memory of 3620 4216 fpsbooster.exe 83 PID 4216 wrote to memory of 3620 4216 fpsbooster.exe 83 PID 3620 wrote to memory of 3408 3620 fpsbooster.exe 87 PID 3620 wrote to memory of 3408 3620 fpsbooster.exe 87 PID 3408 wrote to memory of 1536 3408 cmd.exe 89 PID 3408 wrote to memory of 1536 3408 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe"C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe"C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD520708935fdd89b3eddeea27d4d0ea52a
SHA185a9fe2c7c5d97fd02b47327e431d88a1dc865f7
SHA25611dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375
SHA512f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b
-
Filesize
13KB
MD543bbe5d04460bd5847000804234321a6
SHA13cae8c4982bbd73af26eb8c6413671425828dbb7
SHA256faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45
SHA512dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b
-
Filesize
14KB
MD5c6b20332b4814799e643badffd8df2cd
SHA1e7da1c1f09f6ec9a84af0ab0616afea55a58e984
SHA25661c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8
SHA512d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4
-
Filesize
10KB
MD5fee13d4fb947835dbb62aca7eaff44ef
SHA17cc088ab68f90c563d1fe22d5e3c3f9e414efc04
SHA2563e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543
SHA512dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2
-
Filesize
12KB
MD54d9182783ef19411ebd9f1f864a2ef2f
SHA1ddc9f878b88e7b51b5f68a3f99a0857e362b0361
SHA256c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd
SHA5128f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185
-
Filesize
10KB
MD58f4313755f65509357e281744941bd36
SHA12aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0
SHA25670d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639
SHA512fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
48KB
MD5eb49c1d33b41eb49dfed58aafa9b9a8f
SHA161786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA2566d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
SHA512d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
-
Filesize
62KB
MD5fe9322e00324b59c179d4c9803322b6c
SHA14d27aa7b1d38ee633de49256bb26a9ee47eb9ef1
SHA25646967e4ef54e222dcda43b64032a3f22ed9fce4cebbe0e64288ed80f86a500eb
SHA51229d65bd6e81325cb17ef105a2e4bf3b65c859389da1bd98036227b45bd4496c31aec6427df5fbd7dc9bec482b18d1481abcb7cbfe34dce7229b4a33b971219b8
-
Filesize
82KB
MD53dc8af67e6ee06af9eec52fe985a7633
SHA11451b8c598348a0c0e50afc0ec91513c46fe3af6
SHA256c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
SHA512da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087
-
Filesize
177KB
MD577b5d28b725596b08d4393786d98bd27
SHA1e3f00478de1d28bc7d2e9f0b552778be3e32d43b
SHA256f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c
SHA512d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d
-
Filesize
120KB
MD5f1e33a8f6f91c2ed93dc5049dd50d7b8
SHA123c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
SHA2569459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
SHA512229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5
-
Filesize
261KB
MD517ca59b401eefd4ab19991f1863fb556
SHA15b5b7007edf58fd2af41630ea3dd7ae7a98dd6f2
SHA2567b3fab77197e0a4ed13642f462343ae34c0688156f0665d18f514c61a327b033
SHA512e04be5c17ca717d3d769bac5a21eb3126af0571301003f847557bc21baf3ee470fd6c968f618123a0e2f27b642f52a756d68e5ed429eada16ce9ef9b6f5a5639
-
Filesize
44KB
MD5a6448bc5e5da21a222de164823add45c
SHA16c26eb949d7eb97d19e42559b2e3713d7629f2f9
SHA2563692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
SHA512a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba
-
Filesize
246KB
MD537057c92f50391d0751f2c1d7ad25b02
SHA1a43c6835b11621663fa251da421be58d143d2afb
SHA2569442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
SHA512953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c
-
Filesize
28KB
MD59b1c3fdf64e5e642cec1a82ac76f8184
SHA1a104fc78d15a263319ed003517e6929e193455de
SHA2564aff330cafb4b497cb45a91a2e9e8a64b44f998f582dd795b3df58963d5f76f2
SHA512173e39901e876cc34b44fbe5ed3f3cab170dc007fcbf93c21cc76b684323d83cc6ef6158587d4ab2d7127e881ff4fd98f92d909f2c4a897c153b69b9ed5804ae
-
Filesize
44KB
MD51b04bd84bdd90b8419e2a658a1cacc6e
SHA1c016487aa0455a8bb664f306fb4ad3e7e64811f2
SHA25644f9ed9d97881b29ecc79a2b3077760a4f9f7b5ba386751c0f3b98f1bfb0d8c4
SHA51224e86b3325d00484dd5da6198bd5e935fed0b31c4d1fba8d41340d39863e1e47c499899ca82bf477a007f6a636cf296702ece9b457a43a4aaec6b38569cfa2e3
-
Filesize
27KB
MD544b72e0ad8d1e1ec3d8722088b48c3c5
SHA1e0f41bf85978dd8f5abb0112c26322b72c0d7770
SHA2564aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e
SHA51205853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c
-
Filesize
77KB
MD5d6bae4b430f349ab42553dc738699f0e
SHA17e5efc958e189c117eccef39ec16ebf00e7645a9
SHA256587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
SHA512a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e
-
Filesize
85KB
MD5d2e7ccc8bd1aba0b268ee72577548bcd
SHA1f7a1d15d23348e4d7f1c94769c84923e94d16ac6
SHA25675db26ab9dc51d765d1d98dca63f57a801796ee19fdb87e62be518937584015f
SHA51261d7445d007a176d6a202971d608031cbdf0e1a31fc4be67e85181d3247934f90f24c1954710ecf9c135e90326171bfd210b3f30f22332a7ee898ce5f8e08dc9
-
Filesize
115KB
MD58ee827f2fe931163f078acdc97107b64
SHA1149bb536f3492bc59bd7071a3da7d1f974860641
SHA256eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4
SHA512a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565
-
Filesize
821KB
MD5b0eff6c61421d23055a49a14bd50bee5
SHA19c5070e50d7b8766a637c426f6a0b8cb43644dfe
SHA256dc132bab6aa45b35dd7f8a77e1f7ecf04ede46fdbee43ce49e6a312002a8220d
SHA5125bfdc0f0fc1c269ab2fdb18f3b4d6732fa7dfa3fa83e27e962a0151706a66ddb8439eb5f63367e0b2d0e896333c03d3e79ad8f60aca4ca72a2460e8d4cddb990
-
Filesize
10KB
MD538105df780eddd734027328e0dca0ca3
SHA145f1d9e3472478f8e1ba86675f5c81c00b183bea
SHA2569512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb
SHA512ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3
-
Filesize
116KB
MD5073f09e1edf5ec4173ce2de1121b9dd1
SHA16cdb2559a1b706446cdd993e6fd680095e119b2e
SHA2567412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c
SHA51270a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96
-
Filesize
3.2MB
MD5bf83f8ad60cb9db462ce62c73208a30d
SHA1f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e
-
Filesize
32KB
MD54424baf6ed5340df85482fa82b857b03
SHA1181b641bf21c810a486f855864cd4b8967c24c44
SHA2568c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
SHA5128adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33
-
Filesize
670KB
MD5fe1f3632af98e7b7a2799e3973ba03cf
SHA1353c7382e2de3ccdd2a4911e9e158e7c78648496
SHA2561ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
SHA512a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0
-
Filesize
185KB
MD5e684792507faf113474a6d1217aeeaad
SHA1f9486048ec025a9f469f52c1788a74e70975b431
SHA2561035c85c840c1007d5f5bb62ca7358d6c85b5e4bf15155fe0857c6a17453f18a
SHA5121a50bc231963d405f25879ee3560eb90f7b18d51640b9b4d848f18caa9fef14907f8935a86f093478be0ee0e1261e4bcc8c697b486bc0617c5f77370337d48c3
-
Filesize
57KB
MD57acec875d5672e7aa148b8c40df9aa49
SHA196b8cfabe0cfa3df32995919ac77cfdeec26f1f2
SHA256d96858e433f45917499dbf5e052e56f079ff9ae259fd3caa025c3b1daf852891
SHA5121208da62fe82b779ec822ad702f9ca4321b34ee590c28e10efe9a2db6d582bfdcae01ab2431c1a98714ef0c60434d64c58f3db31bf5886efbb943adc70d6e975
-
Filesize
4.0MB
MD5d2a8a5e7380d5f4716016777818a32c5
SHA1fb12f31d1d0758fe3e056875461186056121ed0c
SHA25659ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7
-
Filesize
26KB
MD56ae54d103866aad6f58e119d27552131
SHA1bc53a92a7667fd922ce29e98dfcf5f08f798a3d2
SHA25663b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
SHA512ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0
-
Filesize
1.2MB
MD56695408dcb79890ed16b7491ba07ea3b
SHA107fdf0d4d167b5893853b71c54df1dce313503ad
SHA256f2e7a0cbfaaaa597d68b923a5360669ab3cd9e643fabdab2aba7c6da91f2b5cb
SHA51212c04eae6771c6a7878034b40deb19c843cfa0438c20fdd5099195d8e12ba9bc64fdc7e367353b08a2ff0788c67eb8b16521918df5a1e133863a44f02de01818
-
Filesize
1.0MB
MD54c0d43f1a31e76255cb592bb616683e7
SHA10a9f3d77a6e064baebacacc780701117f09169ad
SHA2560f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
SHA512b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778
-
Filesize
513KB
MD5a72ac2744631c74b0f2a6b58f255b5f3
SHA1841dcc524c72a9fffca11187bd0fe67c91ac641d
SHA2568e520d0ed8ecc19424b044544d620e670a8f659bf41f9f0a01789451bb6034b4
SHA51221669b710ab8a4584823953426795109d716a47042dd67835d9eb4f0abb216733e2904313fb280a08bf92fcb3e04f84ef04ead5b3cb770473f13febf0a9881e0
-
Filesize
29B
MD5155ea3c94a04ceab8bd7480f9205257d
SHA1b46bbbb64b3df5322dd81613e7fa14426816b1c1
SHA256445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b
SHA5123d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05